Pre-validation of bootloader certificates for firmware bootloaders of an operating system boot list during a setup mode of BIOS boot initiation provides the end user with a tool to address boot certification problems associated with the firmware bootloaders before the operating system boot precludes execution of bootloaders that lack a valid certificate. For example, re-configuration of a boot list to address certification problems before exit of boot setup prevents boot to an inoperative state caused by lack of firmware execution during boot due to a failed certificate, such as a failure to load an unsigned option rom.
|
9. A method for booting an information handling system, the method comprising:
initiating firmware instructions to bring an operating system from persistent memory to an operational state;
executing a set-up state of the firmware instructions, the set-up state accepting end user inputs;
while in the set-up state, validating certificates of option rom bootloaders in a boot list of the firmware; and
applying corrective action for invalid certificates in the set-up state before transition to a boot state, the corrective actions including at least presenting invalid certificates at a display while in the set-up state, and accepting end user inputs in response to the presenting invalid certificates.
16. A system for booting an information handling system, the system comprising:
non-transitory memory storing:
an operating system having instructions that execute on a processor to coordinate execution of applications on the information handling system, the operating system having a secure boot mode that validates bootloader certificates and precludes execution of bootloaders that lack a valid bootloader certificate;
initiation firmware having instructions that coordinate boot of the operating system, the initiation firmware having a setup mode, a boot mode and an exit boot services that transitions control of the information handling system from the initiation firmware to the operating system; and
a pre-validation module having instructions that determine the validity of the bootloader certificates during the initiation firmware setup mode, present invalid bootloader certificates at a display while in the set-up state, and accept end user inputs in response to the presenting invalid certificates to alter the operating system boot based on the invalid bootloader certificates.
1. An information handling system comprising:
a processor executing instructions that process information;
memory interfaced with the processor, the memory storing the instructions and information;
a display interfaced with the processor and presenting the information as visual images;
plural components interfaced with the processor and performing functions with firmware instructions loaded at boot of an operating system on the processor;
initiation firmware stored in the memory and initiating boot of the operating system at power on of the processor;
a secure boot module associated with the initiation firmware and comparing bootloader certificates for bootloaders of firmware instructions for the plural components with valid certificates to validate the firmware instructions, the secure boot module further preventing execution of firmware that lacks a valid certificate; and
a pre-validation module associated with the initiation firmware and performing a pre-validation by comparing the bootloader certificates with the valid certificates before the comparison performed by the secure boot module, presenting the pre-validation at the display during a setup routine of the initiation firmware, initiating transition to a boot mode of the initiation firmware if the bootloader certificates are valid, and initiating transition to a modified boot mode of the initiation firmware if the bootloader certificates are not valid, the modified boot mode launching a firmware update function of the operating system to update the invalid firmware.
18. An information handling system comprising:
a processor executing instructions that process information;
memory interfaced with the processor, the memory storing the instructions and information;
a display interfaced with the processor and presenting the information as visual images;
plural components interfaced with the processor and performing functions with firmware instructions loaded at boot of an operating system on the processor;
initiation firmware stored in the memory and initiating boot of the operating system at power on of the processor;
a secure boot module associated with the initiation firmware and comparing bootloader certificates for bootloaders of firmware instructions for the plural components with valid certificates to validate the firmware instructions, the secure boot module further preventing execution of firmware that lacks a valid certificate; and
a pre-validation module associated with the initiation firmware and performing a pre-validation by comparing the bootloader certificates with the valid certificates before the comparison performed by the secure boot module, presenting the pre-validation at the display during a setup routine of the initiation firmware;
wherein the plural components comprise a graphics subsystem and the firmware instructions comprise an option rom to execute on the graphics subsystem; and
wherein the pre-validation module presents an alternative graphics subsystem to use at boot instead of a graphics subsystem having an invalid certificate, the alternative graphics subsystem selectable by an end user for use in boot through the display.
2. The information handling system of
3. The information handling system of
4. The information handling system of
5. The information handling system of
6. The information handling system of
7. The information handling system of
initiates transition to a boot mode of the initiation firmware if the bootloader certificates are valid; and
establishes a network interface to update the bootloader certificates if the bootloader certificates are not valid.
8. The system of
10. The method of
transitioning to the boot state to prepare execution of the operating system;
exiting the boot state to initiate execution of the operating system; and
in response to exiting the boot state, validating the certificates of the option rom bootloaders before executing the option rom bootloaders.
11. The method of
12. The method of
13. The method of
14. The method of
15. The method of
17. The system of
|
|||||||||||||||||||||||||||
This application claims the benefit under 35 U.S.C. § 119(e) of U.S. Provisional Application No. 62/113,758, filed Feb. 9, 2015, entitled “Information Handling System Boot Pre-Validation,” which includes exemplary systems and methods and is incorporated by reference in its entirety.
Field of the Invention
The present invention relates in general to the field of information handling system security, and more particularly to information handling system boot pre-validation.
Description of the Related Art
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.
One concern that attaches to the use of all kinds of information handling systems is the vulnerability of information handling systems to malware or hacking attacks. Generally, malware is code snuck onto an information handling system that performs functions unauthorized by the end user. In some instances, malware creates a nuisance by interrupting an end user with advertisements or sending unauthorized “spam” from a user's email account. In other instances, malware has a more sinister intent, including capturing personal information of an end user, such as passwords and financial accounts. Malware can sit quietly monitoring an information handling system for extended periods of time, thus placing sensitive government classified information and enterprise trade secrets at risk. Undetected malware that exposes even minor personal information can create major risks for a government or enterprise if unauthorized users are able to leverage the personal information to access sensitive information, such as by guessing passwords.
To identify and remove malware, end users typically run anti-malware applications that search for and delete malicious code. Although conventional anti-malware applications have considerable success against known malicious code, sophisticated malware attacks are generally difficult to detect and defend against. In particular, malware that attaches to privileged administrator access of an information handling system's operating system often includes code that hides the malware from detection. Such malware, known as rootkit malware, uses administrator privileged access to modify anti-malware applications so that the rootkit malware escapes detection. Other types of malware attack code that is not normally monitored by anti-malware applications. For example, malware embedded in firmware, such as option ROM firmware, is not typically monitored or detected by anti-malware applications and often has direct access to sensitive hardware elements. Often, anti-malware applications that run over an operating system do not have access to firmware code and therefore cannot search for malware installed in firmware of embedded hardware devices. Generally, malware that runs in firmware or on embedded hardware devices has to be detected before installation of the malware on an information handling system.
One technique for preventing malware in firmware of embedded devices is to search firmware upgrades for malicious code before the firmware upgrades are installed. Although this technique detects known malicious code, unknown code may sneak past and remain installed even after the malicious code is identified as such. Another technique recently adopted for WINDOWS, known as Secure Boot, is to require that firmware code bootloaders have a signed key recognized by the operating system before the bootloaders are allowed to execute. A difficulty with the requirement for signed bootloaders is that unsigned or unrecognized firmware will not load at boot, thus leaving hardware devices inoperative, whether or not the firmware includes malicious code.
Therefore a need has arisen for a system and method which aids information handling system end users in managing information handling system secured boot of firmware.
In accordance with the present invention, a system and method are provided which substantially reduce the disadvantages and problems associated with previous systems and methods for managing information handling system boot of firmware by initiation firmware, such as a BIOS. Pre-validation of firmware is performed before operating system boot to detect firmware, such as option ROMs, that lack a valid signed certificate. If an invalid firmware certificate is detected, reconfiguration of bootloaders or BIOS settings remains available through a BIOS setup mode before operating system boot so that operating system boot will proceed normally.
More specifically, an information handling system has a hardware layer with processing components that cooperate to process information, a firmware layer with firmware instructions that run on the processing components, and an operating system layer that executes over the processing components and firmware to coordinate application use of information handling system resources, such as input, output, storage and network communications. The operating system includes a secure boot module that validates firmware bootloader certificates for bootloaders in a boot list before the firmware is allowed to execute. A pre-validation module in the firmware layer, such as in a BIOS, pre-validates firmware bootloaders before control passes to the operating system to execute the firmware bootloaders, such as by predicting firmware bootloaders that will fail to pass secure boot checks of the operating system after the BIOS transitions control of boot to the operating system. For example, the pre-validation module compares bootloader certificates in a boot list with known valid certificates to identify firmware bootloaders that will fail to pass secure boot checks by the operating system during normal boot. Firmware that lacks a valid certificate is presented to the end user during a BIOS-controlled boot setup mode so that the end user can perform a boot re-configuration action that will allow a normal operating system boot, such as skipping or replacing invalid firmware.
The present invention provides a number of important technical advantages. One example of an important technical advantage is that an end user is provided with a warning before boot takes place that one or more firmware elements are not authorized or otherwise might have difficulty during operating system boot. Pre-validation of firmware, such as option ROMs, before boot takes place allows the end user to intervene before the initiation of boot and correct an issue that impedes boot before a failed boot occurs, such as by presenting the end user with a BIOS boot setup menu. For example, if a storage subsystem option ROM lacks a signature by a recognized key, pre-validation identifies the potential failure of the storage subsystem before boot so that the end user may select a different boot device before the invalid device fails to load. In one embodiment, the end user is presented with icons that indicate firmware status, such as trusted, untrusted or missing, next to boot entries so that the end user has a clear indication of the status of firmware and risks of proceeding with a boot. In an alternative embodiment, instructions of the system BIOS allow the end user to address firmware status before initiation of boot, such as by reconfiguring bootloaders in a BIOS setup, to ensure that the information handling system boots to a usable state in light of known or predicted firmware issues.
The present invention may be better understood, and its numerous objects, features and advantages made apparent to those skilled in the art by referencing the accompanying drawings. The use of the same reference number throughout the several figures designates a like or similar element.
Pre-validation of bootloader certificates for a boot list of an information handling system during BIOS setup reduces the risk that an information handling system will boot to a degraded state if a boot loader, such as for an option ROM, fails to load during operating system boot due to an invalid certificate. For purposes of this disclosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. For example, an information handling system may be a personal computer, a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, ROM, and/or other types of nonvolatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, and a video display. The information handling system may also include one or more buses operable to transmit communications between the various hardware components.
Referring now to
Firmware layer 14 includes instructions stored in persistent memory, such as flash memory available to components in chipset 34, which coordinate interactions between physical components in hardware layer 12. In the example embodiment, a Basic Input/Ouput System (BIOS), interfaces physical components with each other and acts as initiation firmware that “boots” hardware components from a powered down state to an operational state under the control of operating system 16. For example, BIOS 40 is firmware instructions that execute at least in part on embedded controller 36 to manage power to the processing components and to manage communication of inputs and outputs for end users. Other types of firmware in firmware layer 14 include option ROMs that manage specific devices. For example, an I/OM option ROM manages inputs and outputs through specific devices. As another example, a graphics option ROM 44 manages presentation of information by graphics device 30. Other types of firmware and option ROMs may be included in firmware layer 14 as needed to manage specific hardware devices, such as storage devices, networking device, etc. . . . Generally, the option ROM firmware instructions execute on the hardware component managed by the option ROM and interact with drivers included in operating system 16. Operating system 16 executes over hardware layer 12 and firmware layer 14 to support interactions by applications 18 with resources of information handling system 10.
In the example embodiment, information handling system 10 is brought to an operational state by retrieving operating system 16 from persistent memory to RAM 22 for execution on CPU 20 in a process known as bootstrapping or boot. BIOS 40 initiates boot at power up of embedded controller 36 with instructions stored in persistent memory, such as flash memory of the embedded controller that locates operating system 16 in hard disk drive 24. BIOS 40 executes a startup routine for execution to bring the information handling system to an operational state with an eventual a transition from BIOS control of information handling system 10 to operating system control, such as at an “exit from boot services” provided by BIOS 40. After exit from boot services, operating system 16 performs a security routine to ensure that malicious code is not present in firmware stored or running on processing components of the information handling system. For example, a secure boot module 46 in the operating system compares certificates 48 stored on the operating system that are associated with valid firmware bootloaders and certificates stored in firmware layer 14 for firmware bootloaders in a boot list to be executed by operating system 16. If a firmware bootloader in the boot list does not have a valid certificate, then secure boot module 46 precludes execution of the firmware bootloader. As an example, secure boot module 46 operates in conformance with the Unified Extensible Firmware Interface (UEFI) Secure Boot specification.
Although secure boot module 46 prevents malicious or unauthorized firmware from loading during boot, the failure to load firmware may result in processing component failure. For example, if a graphics option ROM has an invalid signature certificate, the option ROM will not load and the display may not operate after boot completes. Similarly, if a storage device bootloader lacks a valid signed certificate, the option ROM for the storage device may not load, making the storage device unusable. Further, once BIOS 40 hands off control of boot to operating system 16, the end user loses control of how the boot sequence takes place so that an invalid certificate may cause a boot failure that the end user cannot immediately correct. In order to reduce the risk of boot to an inoperative state, firmware layer 14 includes a pre-validation module 50 that compares firmware certificates with valid certificates to validate the firmware before transition from control by BIOS 40 to operating system 16, such as while BIOS 40 is in a setup mode. In the example embodiment, firmware layer 14 includes a secure boot module 46 and certificates 48 to allow a comparison of option ROM and other firmware certificates with valid certificates so that the results of the comparison are available to pre-validation module 50 while an end user is able to interact with BIOS 40, such as in a BIOS set-up mode of operation. If a firmware bootloader has an invalid certificate, pre-validation module 50 presents the invalid certificate to an end user to provide the end user with notice of a predicted difficulty with boot and to allow the end user to re-configure boot, such as by selecting alternative firmware or selecting an alternative hardware device with valid firmware. For instance, if a storage device option ROM has an invalid bootloader certificate, pre-validation module 50 presents an end user with an option to boot using a different storage device that has a valid certificate. In one alternative embodiment, pre-validation module 50 may attempt automated re-configuration of system boot, such as by downloading valid firmware to replace invalid firmware while in BIOS setup mode.
Referring now to
Referring now to
Referring now to
Although the present invention has been described in detail, it should be understood that various changes, substitutions and alterations can be made hereto without departing from the spirit and scope of the invention as defined by the appended claims.
Gillespie, Kurt D., Barkelew, Jonathan B.
| Patent | Priority | Assignee | Title |
| Patent | Priority | Assignee | Title |
| 9246690, | Sep 03 2014 | Amazon Technologies, Inc | Secure execution environment services |
| 9589139, | Nov 04 2011 | Insyde Software Corp. | Method and device for altering a unified extensible firmware interface (UEFI) secure boot process in a computing device |
| 20040025010, | |||
| 20080045342, | |||
| 20100017587, | |||
| 20100169633, | |||
| 20100185845, | |||
| 20120151223, | |||
| 20140250291, | |||
| 20150019850, | |||
| EP1429224, |
| Date | Maintenance Fee Events |
| Aug 18 2021 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
| Date | Maintenance Schedule |
| Mar 13 2021 | 4 years fee payment window open |
| Sep 13 2021 | 6 months grace period start (w surcharge) |
| Mar 13 2022 | patent expiry (for year 4) |
| Mar 13 2024 | 2 years to revive unintentionally abandoned end. (for year 4) |
| Mar 13 2025 | 8 years fee payment window open |
| Sep 13 2025 | 6 months grace period start (w surcharge) |
| Mar 13 2026 | patent expiry (for year 8) |
| Mar 13 2028 | 2 years to revive unintentionally abandoned end. (for year 8) |
| Mar 13 2029 | 12 years fee payment window open |
| Sep 13 2029 | 6 months grace period start (w surcharge) |
| Mar 13 2030 | patent expiry (for year 12) |
| Mar 13 2032 | 2 years to revive unintentionally abandoned end. (for year 12) |